Passwords pasted into chat live forever, but a Cryptgeon note vanishes the moment it has been read. You type a note or pick a file, press create, and get a share link with a QR code to hand over. Encryption happens in the browser with XChaCha20-Poly1305, so the server holds only ciphertext and never sees the key that sits after the hash in the link. Advanced options set the number of views or a lifetime in minutes, and a custom password can be required on top of the generated key. Everything is kept in memory in a Valkey or Redis cache, so nothing is written to disk. Operators tune limits with environment variables for note size, maximum views, maximum expiration, file uploads, and ID length. The interface is a calm monospace page with dark and light themes. A command-line client sends notes from a terminal, and a Raycast extension covers the macOS launcher. Theme text, logo, favicon, and an imprint page can be customized to match a team or company. A health endpoint reports status to proxies and orchestrators. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Google Analytics without the cookie banner or the maze of menus: Rybbit puts web and product analytics for every site you run on one readable dashboard, hosted on your own server. Pageviews, sessions, unique users, bounce rate, session duration, traffic sources, campaigns, devices, and countries update in real time beside a live visitor count. Session replay lets you watch the visits behind the numbers, and user profiles tie identified visitors to their sessions and events. Funnels pinpoint where conversions leak, journeys chart the paths people take through a site, retention reports show who comes back, and goals track conversions from page visits, custom events, and autocaptured clicks. Custom events carry JSON properties, filters slice every report across more than 15 dimensions, saved segments reapply them in one click, and location tracking drills from country to region to city on interactive maps, with optional 3D globe views through a Mapbox token. Error tracking connects JavaScript failures to the affected sessions, so a spike in errors leads straight to the visits that explain it. One install serves unlimited sites and organizations with role-based access, public dashboards share a site's stats through a link, and a tracking script of about 11 KB compressed collects data with no cookies and no consent banner. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Agents with tool use, deep research, a document editor, an IMAP/SMTP email client with AI triage, notes, tasks, and a CalDAV-synced calendar - Odysseus bundles all of it into one open-source, self-hosted AI workspace. It runs local models through Ollama, vLLM, or llama.cpp and cloud APIs like OpenAI and OpenRouter, with a hardware-aware Cookbook that scans your machine and recommends quantized models that fit. Persistent memory uses ChromaDB with hybrid vector-plus-keyword retrieval, web search runs through a bundled SearXNG instance, and agents can use MCP servers, files, and shell access with safety controls, plus custom skills and scheduled agent tasks. A blind Compare mode runs side-by-side model duels with identities hidden and accumulates Elo-style ratings from your votes, so model selection is based on your actual workloads rather than leaderboard claims. Deep research mode - adapted from the Tongyi DeepResearch approach - reads sources through SearXNG and produces cited reports, while the email client tags, summarizes, sets reminders, and drafts replies locally rather than through a third-party mail AI. The writing-first document editor adds AI edits, Markdown and HTML support, and version history. The stack is Python 3.11 with FastAPI, SQLite for state, and a vanilla JS frontend, licensed AGPL-3.0 with zero telemetry. Because agents can read email and execute commands, keep authentication enabled and never expose it as a public unauthenticated service.

With over 21,000 GitHub stars and six years of steady development through version 3.1.0, Neko transforms any Docker container into a fully interactive browser or desktop environment streamed to web browsers via WebRTC with sub-300-millisecond glass-to-glass latency. The Go backend captures X server display frames using the Pion WebRTC library while the Vue.js frontend renders the remote session with native audio synchronization, delivering a significantly smoother experience than Apache Guacamole or noVNC which rely on image-over-WebSocket approaches. Multiple users simultaneously view and collaboratively control the same session with real-time input synchronization and host-managed control passing between participants. Pre-built Docker images cover Firefox, Chromium, Google Chrome, Tor Browser, Brave, Vivaldi, and Microsoft Edge alongside full desktop environments including XFCE and KDE for running any Linux application. Neko Rooms provides multi-tenant deployment with a REST API for programmatic room provisioning, while Neko Apps extends the platform with additional containerized applications beyond browsers. Sessions persist on the server independently of client connections — close your laptop, reconnect from your phone, and resume exactly where you left off. Optional VPN and Tor integration routes traffic through encrypted tunnels for privacy-sensitive browsing. RTMP broadcasting streams sessions to external platforms. The embeddable client supports iframe integration for custom portals and applications. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

When the connection drops, Project NOMAD keeps serving offline Wikipedia, Khan Academy courses, maps, and an optional private AI assistant from a single Debian-based Linux server. The core needs only about 5 GB of disk and under 1 GB of RAM. Content is what fills the drive, and a setup wizard sorts it into Essential, Standard, and Comprehensive tiers while a storage bar tracks the running total. Wikipedia runs from a quick-reference set of the top 100,000 articles to the complete English edition with images at about 121 GB, and Kiwix also serves medical references, survival and repair guides, and Project Gutenberg ebooks. Kolibri adds Khan Academy courses with multi-user progress tracking, and any browser on the network can study. Offline maps cover the whole globe, single countries, or regions, with markers you can search, color, and navigate to by coordinate. The AI assistant is the heavy part, bringing the install to roughly 25 GB. It chats through Ollama or any OpenAI-compatible server such as LM Studio, searches uploaded documents, lists sources with dates when known, and lets vision models read attached images. CyberChef handles encoding and hashing, and FlatNotes keeps Markdown notes. The Supply Depot adds one-click apps or your own Docker containers. Opt-in auto-updates for the Command Center, installed apps, and downloaded content run inside a window you set. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Every major model provider behind one ChatGPT-style interface: LibreChat spans OpenAI, Anthropic, Google, Azure, AWS Bedrock, Vertex AI, Groq, Mistral, OpenRouter, DeepSeek, and any OpenAI-compatible endpoint including local Ollama. You can switch models mid-conversation and compare providers without changing tools. Its Agents framework builds no-code custom assistants with tool access via Model Context Protocol servers, file search over uploaded documents through an optional pgvector-backed RAG service, and a sandboxed Code Interpreter that executes Python, JavaScript, Go, C++, Java, PHP, and Rust. Artifacts render React components, HTML, and Mermaid diagrams directly in chat, and image generation works through DALL-E and other configured providers. Multi-user support is enterprise-grade, with OAuth, SAML, LDAP, and two-factor authentication, per-user conversation history in MongoDB, and Meilisearch-powered search across all messages and files, plus reusable presets, forkable threads, and persistent memory across conversations. The economics favor teams: instead of a ChatGPT Plus seat per person, everyone shares one instance billed per API token, with access to every provider rather than one - and providers see individual API calls, not your accumulated organizational knowledge. Deployment is Docker Compose; API keys and endpoints are configured through .env and librechat.yaml.

Mere Medical pulls the records from every hospital and clinic patient portal you use into one date-ordered timeline, so lab panels, immunizations, and procedures from different systems sit side by side. Each timeline card shows its facility and, when recorded, the provider, and expands with View More; a Jump To index leaps between years. The Summary tab condenses bookmarked labs, medications, conditions, immunizations, care plans, and allergies onto one dashboard whose cards can be dragged into any order or hidden. Lab results are graphed over time wherever the units line up, and a search bar finds specific entries by keyword. Connections sync from Epic MyChart, Oracle Health (Cerner), Veradigm, DrChrono, eClinicalWorks Healow, athenahealth, and NextGen, and several sources can feed one profile at once. Everything lives on your device, so records stay searchable offline and no account sign-in is needed; an optional password encrypts them at rest. Separate user profiles hold each person's records, and JSON export and import make backups simple. Experimental AI features add semantic search that links a phrase like high blood sugar to related labs, plus a Mere Assistant that answers plain-language questions about your records using local Ollama models or an OpenAI key. Install it on a phone or desktop home screen for quick access in the waiting room. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Moltis gives individuals and teams a completely private personal AI agent server that bridges conversational assistants to everyday messaging platforms while executing real-world computing tasks inside secure execution environments. Users can interact with autonomous agents across Telegram, Discord, WhatsApp, Slack, Matrix, and browser interfaces to draft correspondence, automate research, and schedule recurring cron tasks. The system coordinates multi-agent delegation by spinning up specialized sub-agents with dedicated roles for code generation, pull request reviews, quality assurance testing, and technical documentation. Built-in sandboxing isolates tool operations within container boundaries or WebAssembly modules, ensuring shell commands, web scraping routines, and script executions cannot alter underlying operating system files without explicit permission. Native Model Context Protocol integration allows operators to attach external data endpoints, database connectors, and custom command-line utilities without rewriting core routing logic. Persistent memory preserves conversational context and document embeddings across multiple sessions, allowing assistants to recall prior discussions, user preferences, and project guidelines indefinitely. Administrators can configure granular tool approvals, manage WebAuthn passkey authentication, and review real-time WebSocket communication logs through an embedded control panel. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Private text, encrypted before it leaves the browser: Enclosed turns passwords, keys, and other secrets into a link that only its holder can open, with no third-party service in between. Can the server read the note? No. It stores only ciphertext and settings, because the decryption key rides in the part of the link after the # sign, which browsers never send. Want a second lock? Add a password, or generate a random one with a click, and share it by another route. Worried about links lingering in chat history? Pick one hour, one day, one week, or one month, and tick Delete after reading so the first view removes the note, with a warning shown to the recipient beforehand. Need more than text? Attach files by button or drag and drop, and recipients download them one by one or all at once. Sending to a phone? Every finished note offers a QR code, downloadable as SVG or PNG. Setting it up for a team? Restrict note creation to signed-in users, create notes from the command line, and let people read the interface in 17 languages with light, dark, or system themes. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

In-app, website, link, and email surveys feed one open-source experience management platform: Formbricks. Its distinguishing strength is targeted in-app research: a JavaScript SDK triggers surveys on user events and attributes, with segmentation rules like "power users who have not seen a survey in 10 days," so questions reach the right cohort at the right moment instead of a mass email blast. The no-code editor offers 20+ question types including NPS, CSAT, CES, matrix, ranking, and file upload, with skip logic, conditional branching, best-practice templates, and full brand theming. Responses feed built-in analytics with summaries and CSV/JSON export, and integrations push data to Slack, Notion, Google Sheets, Airtable, Zapier, and n8n, with webhooks and an open API on every tier. Because self-hosted surveys load from your own domain rather than a blacklisted third-party script host, ad blockers do not suppress them - in-app surveys reach users that Hotjar-style tools silently miss, which measurably raises response rates. Self-hosting also removes the third-party sub-processor from your privacy policy entirely: survey responses often contain PII, and keeping them on your own server matters for GDPR-sensitive and regulated industries. The Community Edition has no response caps or tier-gated features, so core functionality and your data stay accessible regardless of any subscription. Next.js on PostgreSQL, AGPLv3.

Stocks, ETFs, crypto, bonds, precious metals, and cash across every account and currency, in one privacy-first dashboard: Ghostfolio is open-source wealth management software. The deliberate design decision is no brokerage linking: positions enter by manual entry, CSV import, or the REST API, so your holdings never pass through a data aggregator. Performance is measured as return on average investment across Today, WTD, MTD, YTD, 1Y, 5Y, and Max timeframes, with benchmark comparison against indices like the S&P 500, dividend tracking, and allocation breakdowns by asset class, region, and sector. A static X-ray analysis flags concentration and other portfolio risks, and a FIRE calculator projects progress toward financial independence. Multi-currency support converts holdings using historical exchange rates, market data comes from Yahoo Finance and CoinGecko among other pluggable providers, and everything exports back out as CSV or JSON. Built with Angular and NestJS on PostgreSQL and Redis, shipped as Docker images for amd64 and ARM, with a mobile-first PWA interface, dark mode, and a distraction-free Zen mode. AGPL-licensed.

Stop pasting passwords into chat threads that keep them forever: 1time turns a secret into a link that opens once and then deletes itself. Paste a database URL, an API key, or any sensitive text, choose how long the link may live, from an hour to thirty days, and decide whether one person or up to ten may open it. Add a passphrase when the link alone should not be enough, then copy the ready link and send it through whatever channel you already use. The recipient opens it, sees the decrypted message with a copy button, and the message is burned, gone from the server the moment it is read. Files work the same way up to 250 MB, encrypted with their name and type and uploaded in pieces so a dropped connection only resends one chunk. Encryption happens in your browser before anything uploads, and the key travels inside the link itself, so the server holds only ciphertext it cannot read. A password generator, a command line client, and a browser extension that shares selected text speak the same protocol against your own instance. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Take the tool sales teams use to never forget a client detail and point it at the people who actually matter - friends, family, the colleague whose kid's name you keep blanking on: Monica is a personal CRM. It's a Laravel/PHP application over MySQL where each contact accumulates the texture of a real relationship: how you met, family members and pets, work changes, addresses, notes from conversations, activities done together, gift ideas and gifts given, even debts owed in multiple currencies. Two features set it apart from every contact app. Reminders with staying power: set per-contact intervals (weekly through yearly), get notified at 30 days, 7 days, and day-of, with automatic birthday reminders and CalDAV sync to your calendar. And a journal linked to contacts: write about dinner with friends, tag each person, and build a timeline that's part diary, part relationship log - plus a daily "how was your day" rating. Monica is deliberately manual and deliberately private: no social network features, no AI, no email scraping, no ads, no analytics - a quiet database of what you know about people you love, on your own server. Multiple vaults and users, labels, custom activity types, and document/photo uploads round it out. AGPL-licensed.

Mail-in-a-Box turns a single Ubuntu server into a fully functional email system with one setup command, installing and configuring Postfix for SMTP, Dovecot for IMAP, Roundcube for webmail, and Z-Push for Exchange ActiveSync push notifications in an automated sequence that would take days to replicate manually. The DNS server auto-configures the full suite of email authentication records: SPF, DKIM, DMARC, DNSSEC with DANE TLSA, MTA-STS, and SSHFP. Getting all of these right is what separates email that lands in inboxes from email that lands in spam, and most manual installations never achieve the complete set. Nextcloud integration adds CardDAV contact sync and CalDAV calendar sharing across devices. Let's Encrypt certificates provision and renew automatically for every hosted domain. The web control panel manages users, aliases, custom DNS records, and automated backups, protected by TOTP two-factor authentication. Daily health checks verify that services run correctly, ports remain open, TLS certificates stay valid, and DNS records resolve properly, alerting you before delivery problems develop. Multiple domains and users operate from one installation with internationalized domain name support. Built-in HTTPS static site hosting uses the TLS infrastructure already in place. Runs on a dedicated RepoCloud VPS with guaranteed resources, root SSH, and browser serial console for complete email sovereignty. CC0 public domain licensed.

ODS turns a GPU machine or server you already own into a complete private AI stack with a single install command, replacing a shelf of separate tools with one system that serves models, chat, agents, automation, and search from your own hardware. The installer reads your GPU, VRAM, memory, and disk, then downloads a GGUF model matched to that hardware tier, and a compact bootstrap model starts answering within minutes while the full model finishes downloading. From the web dashboard you watch every service's health, ports, and resource use, restart what misbehaves, and check storage and updates without touching a terminal. You chat with local models in Open WebUI, hand background work to the Hermes and Portal agents, and build automations in n8n that connect the stack to more than 400 other apps. Documents you add become searchable knowledge through Qdrant vector storage, so answers cite your files instead of the model's memory. SearXNG and Perplexica answer web questions without trackers or accounts, Whisper transcribes speech, Kokoro reads text aloud, and ComfyUI generates images, all on the same box. Every bundled service is an extension you can enable, disable, or replace, and a Privacy Shield scrubs personal data before anything reaches an optional cloud model through the LiteLLM gateway. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

The Bitwarden server, reimplemented in Rust: Vaultwarden (formerly bitwarden_rs) is the unofficial lightweight edition. It speaks the same wire protocol as the official server, so every official Bitwarden client - browser extensions, iOS, Android, desktop, and the bw CLI - connects without modification, while the server itself runs as a single container against SQLite (or MySQL/MariaDB/PostgreSQL) instead of the official multi-container stack that wants gigabytes of RAM. Features Bitwarden gates behind paid tiers ship free: organizations with collections, groups, member roles, and policies; TOTP code storage; file attachments; Bitwarden Send; Emergency Access; event logs; and admin password reset. Two-factor options cover authenticator apps, email, FIDO2 WebAuthn, YubiKey, and Duo, and OIDC-based SSO landed natively in v1.35.0. Zero-knowledge encryption is unchanged - vault data is encrypted client-side and the master password never reaches the server. Attachments and Sends store on local disk or S3-compatible backends, an admin panel manages users and server settings, and backup is copying one data directory. Suited to individuals and teams up to roughly 50 users.

Telegram Desktop's export is a file you make once by hand; Telegram Archive is a self-hosted backup that keeps saving your chats on a schedule and in real time, then lets you read them in a viewer that looks like Telegram. After one login with the code Telegram sends you, it stores messages, photos, videos, voice notes, stickers, documents, and link previews, saving each file once even when several chats share it. A live listener captures new messages, edits, and reactions as they happen, and a daily full pass fills any gaps. Every edit keeps its earlier text as a version, and with deletion tracking switched on, deleted messages stay in the archive marked as deleted. The viewer offers folders, forum topics, archived chats, pinned messages, polls, shared media, and search across every chat, plus a What changed feed of deletions, edits, and transcripts. Voice notes can be transcribed into searchable text by a server you run or rent. Family or colleagues get logins limited to chosen chats, or a share link that opens a single chat. One archive holds several accounts, a Telegram Desktop export can be imported for older history, and twelve themes suit phones and desktops. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0-or-later licensed.

One statically-compiled Go binary over PostgreSQL, no ORM, no framework, static assets embedded in the executable: Miniflux is the minimalist, opinionated feed reader. The opinions are the feature: page layout, fonts, and colors are tuned for reading, and everything else is treated as noise. It consumes Atom, RSS, and JSON Feed formats with OPML import/export, organizes articles with categories and bookmarks, fetches original full-text content for summary-only feeds, and provides Postgres-powered full-text search. Privacy work happens automatically: pixel trackers are stripped, tracking parameters removed from URLs, a media proxy blocks third-party tracking, referrers are never forwarded, and there is zero telemetry. Navigation is keyboard-first - j/k through items, o to open, f to star - with touch gestures on mobile. Podcast, video, and music enclosures are supported, and YouTube videos play inline. Over 25 integrations save articles onward to Wallabag, Readwise Reader, Pinboard, Linkding, Instapaper, Notion, Telegram, Matrix, Ntfy, and more, plus webhooks and a REST API with Go and Python clients; the Google Reader API endpoint supports existing mobile reader apps. Authentication spans local passwords, passkeys (WebAuthn), Google OAuth2, OpenID Connect, and reverse-proxy headers. It is Apache 2.0 licensed, translated into 20 languages, and updates feeds on an internal scheduler.